V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
NGINX
NGINX Trac
3rd Party Modules
Security Advisories
CHANGES
OpenResty
ngx_lua
Tengine
在线学习资源
NGINX 开发从入门到精通
NGINX Modules
ngx_echo
mifar
V2EX  ›  NGINX

遇到一个 Nginx 跨域问题,翻遍了资料还是解决不了

  •  
  •   mifar · 2019-01-24 20:53:57 +08:00 · 3954 次点击
    这是一个创建于 2148 天前的主题,其中的信息可能已经有所发展或是发生改变。
           location / {
         if ($request_method = 'OPTIONS') {
            add_header 'Access-Control-Allow-Origin' '*';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
            add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
            add_header 'Access-Control-Max-Age' 1728000;
            add_header 'Content-Type' 'text/plain charset=UTF-8';
            add_header 'Content-Length' 0;
            return 204;
         }
         if ($request_method = 'POST') {
            add_header 'Access-Control-Allow-Origin' '*';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
            add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
         }
         if ($request_method = 'GET') {
            add_header 'Access-Control-Allow-Origin' '*';
            add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
            add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
         }
    } 
    

    已经配置了这段代码,但是依旧提示跨域问题

    Access to XMLHttpRequest at 'https://xxx.com/activity/faceCompare' from origin 'https://bb.xxx.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values 'https://bb.xxx.com, *', but only one is allowed.
    

    求解决方案,谢谢

    15 条回复    2019-01-25 10:05:35 +08:00
    Kyle18Tang
        1
    Kyle18Tang  
       2019-01-24 21:11:48 +08:00 via Android   ❤️ 1
    The 'Access-Control-Allow-Origin' header contains multiple values 'https://bb.xxx.com, *', but only one is allowed。这不是说只允许一个你配了俩?
    mifar
        2
    mifar  
    OP
       2019-01-24 21:28:25 +08:00
    @Kyle18Tang 所以 Nginx 配置没问题是,是前端地址配置多了么?
    nzzzg
        3
    nzzzg  
       2019-01-24 21:37:37 +08:00 via Android
    看情况是多配置了一个,我之前遇到过类似的,是因为有多层 nginx,然后有两层都配置了 add_header,就会出现这种情况,不知道你这个是不是?可以先把你自己设置的去掉,然后发个 options 请求看下响应头
    Kyle18Tang
        4
    Kyle18Tang  
       2019-01-24 21:48:27 +08:00
    @mifar #2 你 location 外层是不是也配了 add_header?
    mifar
        5
    mifar  
    OP
       2019-01-24 21:59:23 +08:00
    @Kyle18Tang
    @nzzzg

    bb.xxx.com

    ```nginx
    server
    {
    listen 80;
    listen 443 ssl http2;
    server_name bb.xxx.com;
    index index.php index.html index.htm default.php default.htm default.html;
    root /home/xxx;

    #SSL-START SSL 相关配置,请勿删除或修改下一行带注释的 404 规则
    #error_page 404/404.html;
    #HTTP_TO_HTTPS_START
    if ($server_port !~ 443){
    rewrite ^(/.*)$ https://$host$1 permanent;
    }

    location / {
    if ($request_method = 'OPTIONS') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    add_header 'Access-Control-Max-Age' 1728000;
    add_header 'Content-Type' 'text/plain charset=UTF-8';
    add_header 'Content-Length' 0;
    return 204;
    }
    if ($request_method = 'POST') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
    if ($request_method = 'GET') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
    }

    #SSL-END

    #ERROR-PAGE-START 错误页配置,可以注释、删除或修改
    error_page 404 /404.html;
    error_page 502 /502.html;
    #ERROR-PAGE-END


    #禁止访问的文件或目录
    location ~ ^/(\.user.ini|\.htaccess|\.git|\.svn|\.project|LICENSE|README.md)
    {
    return 404;
    }

    #一键申请 SSL 证书验证目录相关设置
    location ~ \.well-known{
    allow all;
    }

    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
    {
    expires 30d;
    error_log off;
    access_log /dev/null;
    }

    location ~ .*\.(js|css)?$
    {
    expires 12h;
    error_log off;
    access_log /dev/null;
    }
    access_log /www/wwwlogs/bb.log;
    error_log /www/wwwlogs/bb.error.log;
    }
    ```


    xxx.com

    ```nginx
    server
    {
    listen 443 ssl http2 default;
    listen 80;

    server_name xxx.com;
    index index.html index.htm index.jsp;
    root /home/face_fronted;

    if ($scheme = http ) {return 301 https://$host$request_uri;}


    #SSL-END

    #ERROR-PAGE-START 错误页配置,可以注释、删除或修改
    error_page 404 /404.html;
    error_page 502 /502.html;
    #ERROR-PAGE-END

    #REWRITE-END
    location / {
    if ($request_method = 'OPTIONS') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    add_header 'Access-Control-Max-Age' 1728000;
    add_header 'Content-Type' 'text/plain charset=UTF-8';
    add_header 'Content-Length' 0;
    return 204;
    }
    if ($request_method = 'POST') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
    if ($request_method = 'GET') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
    }
    }

    location /face {
    #处理跨域问题开始
    if ($request_method = 'OPTIONS') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
    add_header 'Access-Control-Max-Age' 1728000;
    add_header 'Content-Type' 'text/plain; charset=utf-8';
    add_header 'Content-Length' 0;
    return 204;
    }

    if ($request_method = 'POST') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
    add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
    }

    if ($request_method = 'GET') {
    add_header 'Access-Control-Allow-Origin' '*';
    add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
    add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
    add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
    }
    #处理跨域问题结束

    #rewrite ^/common/unauth https://xxx.com/face/common/unauth permanent;

    proxy_pass http://127.0.0.1:9080/face;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Host $host;
    #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }



    #禁止访问的文件或目录
    location ~ ^/(\.user.ini|\.htaccess|\.git|\.svn|\.project|LICENSE|README.md)
    {
    return 404;
    }

    #一键申请 SSL 证书验证目录相关设置
    location ~ \.well-known{
    allow all;
    }

    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$
    {
    expires 30d;
    error_log off;
    access_log /dev/null;
    }

    location ~ .*\.(js|css)?$
    {
    expires 12h;
    error_log off;
    access_log /dev/null;
    }
    access_log /www/wwwlogs/xxx.com.log;
    error_log /www/wwwlogs/xxx.error.log;
    }
    ```
    mifar
        6
    mifar  
    OP
       2019-01-24 21:59:47 +08:00
    外层应该是没加
    lululau
        7
    lululau  
       2019-01-24 22:04:10 +08:00 via iPad
    上游加了吧
    mifar
        8
    mifar  
    OP
       2019-01-24 22:29:58 +08:00
    @lululau 没做 cdn 这样的,直接就是服务器访问呢的
    Vegetable
        9
    Vegetable  
       2019-01-24 22:36:24 +08:00
    可以看出你的 origin 里包含了*和域名,域名现在看不出来哪里加的。
    你可以考虑先去掉 nginx 的这一条,如果能正常访问,你就要找这个域名是哪里加上去的。
    btw,可能是前端开发环境影响?
    hasdream
        10
    hasdream  
       2019-01-24 22:51:45 +08:00
    proxy_hide_header Access-Control-Allow-Origin; # 隐藏从后端返回 Access-Control-Allow-Origin 头
    kimchan
        11
    kimchan  
       2019-01-25 09:13:07 +08:00
    额.. 难道不是因为 allow-origin 配的"*" 的缘故吗? 你试试把 * 改成单域名试试?
    dilu
        12
    dilu  
       2019-01-25 09:15:24 +08:00 via Android
    这种情况是你配了两个一样的 header,我以前遇到过,我在 php 中输出了 header,结果测试环境的 nginx 也有人配置了跨域,就会报这个
    yc8332
        13
    yc8332  
       2019-01-25 09:58:19 +08:00
    都是直接后端进行这个配置。。
    yc8332
        14
    yc8332  
       2019-01-25 09:58:58 +08:00
    还有一种情况是,配置* 是不行的。。。有些必须要具体域名,不能*
    br00k
        15
    br00k  
       2019-01-25 10:05:35 +08:00
    被设置了 2 次。你们后端部分是不是也有设置一次。
    关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   实用小工具   ·   5068 人在线   最高记录 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 26ms · UTC 07:40 · PVG 15:40 · LAX 23:40 · JFK 02:40
    Developed with CodeLauncher
    ♥ Do have faith in what you're doing.